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mm<n&m iDsn^tiiit, i Dsu^^xm^mwi ds 

mi IB n T*iR*gT>-CiRS £ fi tz n ^* [z o v » r L T 1=31 i" h t- ? ^ - X <h , 

huis utnz&tfz Mtmx&M vxta <7)m%mn^m & % mm xtk%\ -> * t 

* 1 KSBtto I D S ^Hf^lM^Mo 

£ t &*HRfc-r*»3jfcE 1 Xfi 2 Kfa*<0 I DSMJIMo 

bu ib o ^ ^ is tt * hu ib« xtfc*n v * t a (Dimmnmrn & % mm xm%a > * r- 

imttx, ^^m^ iix^^mm^ WMmm.i}mi}\\Ltzt mura* 
&ctztnm^&T**Amfrffi^m.zGt&z\t£!&mtirzm>£mix&2 
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m t E o £> tt & fuf S« A*£*n y^fA <7M£iI*til#JI ^ h mm Al££n yXfA 

z. t zmmt-t&imm 1 xt± 2 kkiro i d s^isgte 
m 12 a ^ n & tt * mrie« A^^a ^«kw*hii tf> «b a*&&i -> * t- a 

HIS«<7) I DSMJISto 

8 ] BufEn ^5-*fSPI±, 

lute n ^ k & tt £ mo hq i mfee>*ML<owce$> z> mmm%.$k 

^T<Dmmmmmz^x<DMm{MmmtzwftL. ^mm^mmm^tm 

mi- % Hffi¥s#*f¥a £ w-t z> - 1 **3f ft t -t & mMm 1 1 wrtifr— 
m^mmn 1 d s 
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Sftm 2 0 0 3 - 1 1 2 4 1 4 ^- v : 3/ 

mm$k<vm At£*o ->xf ac^h^ »a s « ->xta a*&£q v x 

-r A £fe cotton ^<7)#IT' * & 7" n 7 r ^ ;u £ £ Jtfic L , 

[»^10] sulci IDS Jt^c#^ f± . MU&B-fuy t 4 )V<nm fflM A 

-r^mmmamm^^h z. t s:#att4t*« 9 ma^o 1 d s 

"h±r "F 1 

tZHfrmt-fZ IDSn^MilMo 

[W*^ 1 2 ] frss^fttati. 

fj I e n ^ ic £ it & tu |B« AfMn v X f A O^S^fl rt> h mm X&M y^f 
^ o^HttfUiJ^ 77*xo ^-cab * rtlfil § n V t , ffifSn n £ »t * l£«H 

^mtfj «b m^«^^mj^co ^fp] § n ^ t * m^kitm l , 

mfc8c*£* tc^tt^ -toss * ^-rsims * ffl v > t . mut^ 1: £ ^s^j if 

Bute u7[z&tfz> m a« A#:*n y^fA mmmnmm #» h m& A1&& ->xt 

o 
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Ml Ulil2 I D S frflr^df >V&o 

[If 1 5 ] mrffi^MSii, 
itu fi£ n ^ K js it & mrlfiftA^ y^fi, WHtticfU ^ <b f£« A*&£fl ->XfA 

o 

[if M l 6 ] mifiE^#^gi(±, 

mu n ^ k 43 tt -i> hu i s« A*&£n > * f - a (oi^mn^m h mm. A$t£n -^ta 
® jt k o v> r s^M&m l , ^w&m £ fix v > v^a^ o^jgjg^iti&n l t 

Ml Ulil2 KIE*0 I D S 5t#»^^ 0 

[mini «rsa^«fftfea»±, 
hu i e n ^ n jo tt & m m<om m ks- t fi %> m^mm ^x^^mmmm^t, 
mmmnmmz n ^^mm^tfi^mm^mm^x^^>m.mmm.wt(D 

[WM i 8 ] mis^^ati, 
BtriB um&ifz ffim<r>jg.&ffl m-sttiz pjrm^^mx^,^ mmm^wn 
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mmt^mzmmmmmrnxmnLfz^zm^x, m-B^ctz^^m 
^-scEio i d s ^^mum 0 

hu IfiMfciii , mi ffi^ilfcoft A1Mn v x t a u & it z> — o on Af££n -> x f 
A -c#> & & g « AfMn ->^rA comfien yoOfcffiiX ^ Z> mg-fuy r 4 )Vt, m 
m$k(Dii xtitim v x x a & tt & mm g m A*££n y^fA ^i-<7>« Af££a -^f 

A Coi^^n^ #^-C & £ It "7° n y r 4 )V t £ it$c L , %%. Jt^* 

[it 2 o i Bute i d s jti&Mti, Huievig 7°u-7ts( )V(Dnmm^ 
\zti>%n mhmft t , mtzm^y'u 77^ ^ou# Rugate t i> & ^ %mm% t 

[»*]g2 1] Sii $ At^ll •> ^ f A (7) o ^* ^ Mt ^ I 
D S n ^5Mr3:fl7 0 n A HioV^T, 
hu fS« A*££fl v x t- A ^ iu fe n ^ £ & n ^JR*x x 7 "7° t . 
mff B n x f- y $ *i tz n ^ K o v » T L X mmir Z> r*- 9 ^ - 

Ml fir*- * ^ - x i fcx -f ? ^-e^a $ntv^D^:ov>T ^ft *• £ «5 ^tfr&L 

huie ariztsitz mtmxtfiZa -^t ^mmm^mm & h mm a&*d -> * -r 

A OlSflttigUIJ^O yx*$>2> rtfp] |: n ^* i: N flfrgen $r n £ it 3 f£{£ft 
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^-v: 6/ 



tm&ftiZk U & it * -gcoflJt * tfI-^HM * ffl ^ f , &mttf*kl,tz fr&frm m 
t^rt^WM^f 7 7 s ^f t^> : t *m$kt-thmim2 l KfBtto I D 

2 3 J mfien ^#$r* x y -/(±, 

Htrte n n is it £ frSEft A*fc*n ->xta ojJN^iiJtgniJ ^ <b i£« xtfcfci -> * ^ 

[W*5 2 4] MfSn $r##f y 7l±, 

§ tc, mntfUi ctztmmir&T 7^7 f 7^tn:^ t 1- 

*Sf^2 llli2 2 CffifcO 1 D S 5M7f 7'n^*7A 0 
[fflf*^ 2 5] ftuffin ^flf X t- y 7 0 fi, 
MIS o ^ is it £ itfrffi£ Atfcfcl v x r- A O^it^fiiJ t> AfMn v 7 t- A 
O #fSH*t#Hi ^(D T 7 -t X n $r -e * & ^(6] # n <7) £Hf 7c rt*JR -f £ IS £ 0 ffi J| 

mm% s <r>mmmz%cmtf$>'?fc tn:, tw-t^ r 7 j t7m^-m 

7ry7°$ : yg-fZ>Z.t$:!Si$fflit'$-Z>imm2 1X142 2 KfEfcO I D S 5Mr3fc« 

[1**^2 6] iien^tfXf 77'li, 
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[If 2 7 ] iulfia ^flr* x v 7li, 

mriB o ^ n & tt ^> p/rM^F^ k $ t ti h m^mm^nx*) h mmmm$k t , 
t- -j yzm-t z> c t^mmt-t *»#«2 17^2 6 ^^-rtL^-^tzgsm^ i 

[ 2 8 ] mrlfi n ^'^^ f v 7li , 

m is n ^ u & it £ m ^ m^iti&mm<vmML^V'&&mfflmm%k 
m^m. t^i^ Mn^isMiit l ti&m * m v » x . i: £ * * u 

a->xfAT^^a g « x^:*n vxta o tu is n 7<Dmwx$> & -417^77^ 
^ £ > mmmnm x&%a -> * x a h & it & g « Ama yxt/, JW<7>fs aj& 

a->^tA o^t<7)D ^<0iT»-e^> & 7^77^^^ Jt^ L . f^Jt 

3£*£*m^fiW±^M^ ? &ofj<h It:, Cfz tmWr-fZ IDS tfcix 

XT- y7°^^ri-^>Ch*#fi ( hi-^>lt*^2 17^2 8c7)v^-ftL^— ^tcism^ 

im&m 3 0 ] iuie 1 d s itm* t ? mm&B 7*07?^ ;kt>b#fb^ 

lzti>ten ^.mmR t , bu 7° o 77^ ;kt)B# FbI^I tc t & £ ^ ^t|)^ 

mm-t&mmviUitmxT y 7°z^-$-z>^t z^mt-t z>m^m2 9 ms^o 1 
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*&m 2 0 0 3 - 1 1 2 4 1 4 ^- v I 8/ 

[0 0 0 1] 

^5£Wt*. HAI^yXf A (IDS : Intrusion Detection System) frblti 
l)Zti&ar<Dfr%rlz<D^x3Lmi-2> I D Sn^M^l, i d S n^ff 
3dt?r&£ IDSn <fftffi3:m y° uy?A iz mir2> 0 
[0 0 0 2] 

(WT, #H IDSH^) ZmX-f&^J h^iix.TV^ Q -Ifeic IDSli, 
[0 0 0 3] 

) o 

[0 0 0 4] 

umicm. i ] 

#13 2001-356939 
[0 0 0 5] 

mwtmikLXi t-rzmm) 
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0**hgj Izmir &mi£i£Z¥iS^T)i<Mi<zmQtir2>i><DX*$>2><DX% filT 
[0 0 0 6] 

-r * *> , ±i i k ggff ztitzu vmmmmmm a. ? w-?^ 

[0 0 0 7] 

fit, fl£*K*5V>TI±, HHHC(ii»A£*i£ I DS&ZoitWiWiZti. # 
* jl u r- -f *ttm<& tf> v ^ -r A K *J"T * #^&£a & £\ ^vi Hffi^J £ *i& %ft & 

[0 0 0 8] 

niDSCi «9 m^£*i&n?*off^ s fl& *K x%mztt1rZ> I DSORSti 

tfc, ta£*tzi5^T»±, m.mzmm-rz> id smzurmtj (D 

[0 0 0 9] 

<Dt£\,*is7*T\ Srtfeftl J. > y > ^ e> glJEfc-f SsK'J y-f a-i> S £>* 
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[0 0 10] 

* & A Jt 6 ftjf * 1ft* -5 ft A^<7> K (i— jLfcSfc « ;b *i & ^ < <D n ^ 
[0011] 

s □ yftffi^cM. -fur^u <*>t§# & i & t -t z> 0 

[0 0 12] 

[IIS * » £ A6 <75 ^f£] 

IDSn^lfJiit^IitSo 

xmt\frffi*-tz><Dx^ m^izu retell & Mm muffle. (mx.i£^m^t) 

[0 0 13] 
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[0 0 14] 

If tE O S Ji— & £ Jr<7)i%mttMl) 5 m LX^&mtffl— <Di><D v > <r> T\ Mz. iS 
[0 0 15] 
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[0 0 161 

TT v> & £ t fc* 4- f^l" %>z\t # & o £*Ui08x. fi: fSH*ta^ <b ^a^<7) r 
[0 0 17] 

v > & v^®£ Lfctziz, mn&ZL c tz t mm-t & r ? -t * m 

[0 0 18] 

^ftmKxtta. m^ts¥&mzttir&Mm&ML&<nttmi> s gw Ltzm&n. 



UJSE#2 004-3024851 



&m 2003-112414 



^-v: 13/ 



t&X&2> 0 

[0 0 1 9] 

"C mW- L IS* Sr ffl ^ X , H1it^£ C £ #| if -t Z> HH^B £ W 

##§9! K <fc *i ti\ gAta yXfAWD?*^ > T & £ * £ ffi L T 

£ ffl </ > T ^#7& ? £ £ tz fr&frm Wf-f n r K £> It & pfrM^m 

m& <Di£b^£Mc&z^mLxmi%tf&£tzfr&frzmmir&zt& 

X£Z>o 

[0 0 2 0] 

JttS!iHi*H3f^fl[JJ)L±o^it**abofcfc§^, SflT^t^fciRIBf-t-a I DSJt 

m^m*icf2> z t *mmt i-& 0 

h 7 - * f ) o ^ <7)#^o^*t^ (-f^hf^yhftf) 

IZ-D^ixmffiLX^fziiiDZ^ *#&9§ K «fc *U*, M%l<D 1DS<D uy£tt.t<£<D 
-?*><7)— o<o I DS<^>n^t SrJttSELT, ^- I D S <7)n ^<7)H#Jg*#lJ»fi" * - 
trfX*£Z>o 
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[0 0 2 1 ] 

I D S of£if it v - a Ki£2fc Ltzis^t £ <h *ij Iff 1" h d £ * f T § & 0 
[0 0 2 2] 

$ Af££a y^fAron^ 3e^S W MX* L > Bute n^cov^tf-^^- 
[0 0 2 3] 

^ ~> * 7- a o^siit^ni ^ ?> mm Aim v x -r a o^itafflu^ 

m ZTp-tmum * m ^ x , nnr c £ ^s^^j nr 1- & mmnm^m^m z m 

[0 0 2 4] 

m % <r> femmm \zm& z u n , #^^*n £ n r ^ & is h£ oi^Mifi »t& ? £> o 

[0 0 2 5] 
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stfta ^n-cv^^v^ia^<7){±s ^ « *p l £ £ # k , nnr i: tz t m m •* 
h r 7 -tr 7s mfrffi&w. * w-r * - 1 z m gfc t -t * o 

[0 0 2 6 J 

-2) o 

[0 0 2 7] 

Iff^l 6IB«OH^t±, ffirfa^Ma* 5 , lufSn^i;fctt<i>iiufS«A 
f££n -/Xta <^«ffi^M ^ e> i£« Atfcfci ->xta <DWUm*m® IJ^O r * -t * 

aifcfci $ tit ^ & v^n^ ntftmmm&mu Ltztz^ mn&tk ztzt mm-r 

[0 0 2 8] 

o 

[0 0 2 9] 



miiE# 2004-3024851 



#M 2003-112414 



[0 0 3 0] 

ttz, IS^l 9ie«c<7)f§0^(i, mtimEffl^li. Vi%Wwl&1gbXtfi%\ v^-r 

r n/ , i^t<?)ftA^ v x r- a & it * f£v± g ft A1££fl - >xf A J^<7)ft 
AJ&& v * f A Cov^wn ^O^T* & £&£"7° n 7 r >f ^ <h * Jt 12 L , 
»Jtttte*tc^ffiJ^±(^3lil7&«jbo^: <h # ipJBf-r* I D S 

[0 0 3 1 ] 

)V<D\%mmM^ tinted mhtkUt , iKrfBtt:^:/^ 77^ ;i/tf>H#Ki!£iiSK t44 
[0 0 3 2] 

$n^fAtay^fAOD^^^ti I D S n^^f^^n^^AtciJV* 
y iWSEt'- ft* -r * ^fI$*itv^n^(:ov»tStfS: «9 

o 

[0 0 3 3] 

r * -t * o ^r-^> & i*j (6j § n t , m is uy\z&\,iz> mumnmm h mimm 
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[0 0 3 4] 

[0 0 3 5] 
[0 0 3 6] 

hu I£« Alt ->Xr A <^«ff ^tti ^ <b i£« Af&£n ->XfA <7)#^Ii^^fffi^ <7) 
[0 0 3 7] 

HUie« A1&£n y^f A tf5f*«*t*llll AtfeftI v x f- A 0*«KJt^«^o 

[0 0 3 8] 
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[0 0 3 9] 

i tz , If Jfcm 2 8 (i , tuIE n t y strfB n ^ iz £ tt & 

[0 0 4 0] 

£&oT£*K Bufan^'^ffXT- y 7 Q fi. mrfBH&O&AlfcSn y^f A Kistt* 
-oco« At££n y^fAti^ai « Alt £fl v X t A co^fs n >f<r>%mx$> h v± 
1^77^^, ^imo«A^'>XTAtij3lt^Mv±S«A^vXTA 

[0 0 4 1 ] 

i If ^ 3 0 ifimo^li, tuIS IDS JttSU t v HufBffig -7°n -7 

[0 0 4 2] 

j^t , Elm * #hs l r v>nm mm \z. o ^ x mm^- „ 

m 1 i±*%W<r>miM<nfim^&2> IDSo y ^ f a o jgfflf is ^ 

aiIE#2 004-3024851 



Wm 2003-112414 



s<-Pl 19/ 



ItOt-f fA, B, C^-etL-rn#A$*t^I DS 5 0^<b<7>n^5 1 S-IR^ 

fit, t>f bA, B, C&l D S 5 OO^fi^T^^o 
[0 0 4 3] 

IDSD yfr%t3£mi/X t A 1 (IDSD ^frtff^dl^fi) (±, n ^JRfcgp 1 

t'f bA, B, C^n^tL<7) I D S 5 0frb&>kttijjZtiZ>ur5 1 fc568!WK 
J|X*-f£ t>"-?^-^2 0t±, n^JR^aji 0-ei|X^$tL7tn^5 

1 i:o^tfi1?XO t tit'5<)0 , e*4o D^|fl3 0li, 0 

[0 0 4 4] 

n ?*JR*g&fi> I D S 5 0 wffn > V - ;i/_t<D n ^ 5 1 RZFtfCftl^ > V > t 
fi3> V-)\si)*1fc&Ztitz I D S 5 0_t<7>n^5 1 Uf-SMb/** £S CXm 
JW»twiR**ffv^ a-?^:7*-7^ b^of-^^-X2 OC^t^ 
0 n ^flrSB 3 0 (±, r-^^-x 2 0t-f at^n^WtLt^iM 

o 

[0 0 4 5] 

x. WTSnort, ICEcap, Si teProtector, Secure I D S W4o £^lf & CI <h 7& ? -C 
# & Q d 2 (iSnort(7) n ^*"C^> -?> Alert "7 r -tf ;K7)[*]^^^i-^^J|21-eab^o 
[0 0 4 6] 

12t:^tJ;^:, ^n^*(i, [**] T*B£ titz i/tr^rvlDb 9 s7^*f-* 
^(7) [**] <0ffiT-t?** o n^icti, ^BB#, Source IP/Po 
rt (iH-fSTC) . Destination IP/Port (£HS3fc) , Iffi^n h n;i/^t*<7)M^ 
t^tLti^o SnortCfi, Alert 7 r >f )V VlftK & , if ffiJRS^BB-r^Scann ^ 
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7r-f ;l/7& f m^j$n^ 0 f^Ho(7) IDSny (ICEcap, SiteProtector, Secur 
e IDS) i:o^Tl), Snortn V t RtfcfcJIB Ti^o 
[0 0 4 7] 
(^7^-? £DBI£wt) 

-r-^-X 2 0<7)l5ft^ov^Tl^H^i-^> o =§-fjt<7) IDS 5 O^fo tti^J 

^-x 2 0 £f£fti"&o Ctifi, I D S 5 0 eoff3I^;ov>T5Mfrx^;w<7>j£^ 

[0 0 4 8] 

• m* • 3fc£% • &«£ • &§S5 ( 3 ) , ^-y^htx^ t 

LX<Dm=^<7)T%W (l^;V4) , DDoSl^S (l^^5) ij^fhilho 
[0 0 4 9] 

d ^IjcS^^L^O^^^fl^Ttz^C, TSensor IDJ XO* r>?**if- 

X 2 O^Btt^o 

fit, J£^7C (Source) tJkWMW. (Destination) Zjm&fzfrM^ TSourc 
e IP/portJ [Destination IP/PortJ Cifl CI r*— 9 ^- X 2 0 <7> 

S (^S^Parameter) J 1$ & 5t#r-T£ iti^f'-i'^-X 2 0^ 

[0 0 5 0] 

±15^^ (^g) $:Sot^DBt**^7 ? -^^-^2 0Hi5!t-i.f-7';K7) 
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y*--?'yh<D—M*m3frbm5\,Z7F't-o EI 3 ti^x- -?)VXh 0 , H4(i 
v tf-^K^f), Hi 5 l±*&/ * 7^-?f-^K-*4o 

10 0 5 1] 

IDS(7)n^i;ov^Ifflt (n^Uf»3 0) ^Mt^IliLtii, f 
Source IP/Port J > Destination IP/Port J [is tf&lfhtl 

[0 0 5 2] 

g LtzfrffiZfti i><DXh%> 0 fit, ^ftffi'**->5^^7^t LTfi, i*i 
[0 0 5 3] 

vmn%L<n>$mx~ vfrhftm (t'f na, b, ci*o <?m> 

[0 0 5 4] 
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